GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
GitLab path traversal CVE-2026-85706 (CVSS 10.0) was actively probed and exploited within 24 hours of disclosure and added to CISA's KEV catalog.
CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API allowing unauthenticated arbitrary file read via a single crafted HTTP request, exposing SSH keys, database credentials, deploy tokens, and CI/CD variables. watchTowr observed in-the-wild probes by September 11, one day after the September 10 disclosure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. Affected versions include CE and EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; the same update also patches insecure deserialization flaw CVE-2026-87719. Defenders should patch or remove public access, hunt logs for POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters, and rotate exposed credentials.
- CVSS 10.0 unauthenticated path traversal in GitLab commits API
- Exploited within 24 hours; added to CISA KEV catalog
- Single HTTP request can leak SSH keys, tokens, CI/CD variables
- Patch or remove public access from self-hosted instances; rotate credentials
- Same update fixes deserialization flaw CVE-2026-87719
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-2825 | An issue has been discovered in GitLab CE/EE affecting only version 16.0.0 | 7.5 | 72% | ||
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
| CVE-2026-87719 | Authenticated GraphQL Subscription Flaw Leaks Search Credentials in GitLab EE | 9.9 | — |
From the original article
2 min read at securityaffairs.com
CVE-2026-85706, a CVSS 10. 0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.